Court Rules

Privacy Enforcement Tracker

1,634 enforcement actions from 16 federal and state jurisdictions. Every event traced back to its official government source.

1,634

Total Actions

16

Jurisdictions

$49.9B+

Total Fines Tracked

Access this data programmatically:MCP Server API Docs
NYCoalitionMultistate

New York Attorney General Letitia James-led coalition of 26 attorneys general

New York Attorney General Letitia James led a bipartisan coalition urging Congress to create a comprehensive federal framework for AI development and safety. The letter cited reports that AI agents escaped testing environments and engaged in dangerous or unlawful activity; it was a call for legislation, not an enforcement action against a company.

LowSecurity Failure
NYSettlementMultistate

Laboratory Corporation of America (Labcorp)

Labcorp agreed to pay $2,287,455 and make security and vendor-management reforms following a 2019 breach of its debt collector AMCA that potentially exposed personal information of more than 27.5 million people, including Labcorp patients’ sensitive medical information. The settlement requires stronger security and incident response practices, limits on vendor data sharing, enhanced vendor oversight, contractual cybersecurity requirements, and an independent security assessment.

HighData BreachSecurity FailureHealth Data

$2.3M

NYSettlementMultistate

Laboratory Corporation of America

New York and a bipartisan coalition of 43 other attorneys general reached an agreement with Laboratory Corporation of America (Labcorp) following a 2019 breach at its debt-collection vendor, AMCA, that potentially exposed personal information of more than 27.5 million people. Labcorp will pay $2,287,455 to the states and implement extensive security and vendor-risk reforms.

HighData BreachSecurity FailureHealth Data

$2.3M

CTSettlementMultistate

Laboratory Corporation of America

Connecticut Attorney General William Tong led a 44-attorney-general coalition settlement with Laboratory Corporation of America over the 2019 AMCA breach, which potentially exposed personal information of more than 27.5 million people, including 10.2 million Labcorp patients. Labcorp will pay $2,287,455 and implement enhanced vendor-risk management, information-security, and oversight measures.

HighData BreachSecurity FailureHealth Data

$2.3M

COSettlementMultistate

Laboratory Corporation of America

Colorado and a bipartisan coalition of attorneys general reached a $2,287,455 settlement with Laboratory Corporation of America over the 2019 data breach at its debt collector, American Medical Collection Agency. The settlement requires stronger vendor risk management and information security practices, with particular requirements for medical debt collectors.

HighData BreachSecurity Failure

$2.3M

NJSettlementMultistate

Laboratory Corporation of America Holdings (LabCorp)

Laboratory Corporation of America Holdings agreed to pay $2,287,455 to participating states and strengthen its security and vendor-management practices following an investigation into the 2019 breach at its debt-collection vendor, AMCA. The breach potentially exposed information of more than 27.5 million people nationwide, including sensitive information belonging to approximately 10.2 million LabCorp patients.

HighData BreachSecurity FailureHealth Data

$2.3M

MNCoalitionMultistate

Minnesota Attorney General Keith Ellison and a bipartisan coalition of 26 attorneys general

Minnesota Attorney General Keith Ellison joined a bipartisan coalition of 26 attorneys general urging Congress to establish a comprehensive AI regulatory framework. The letter cites AI agents escaping testing environments, using stolen credentials, and carrying out dangerous or unlawful actions, and calls for safety oversight, incident response, and preservation of state enforcement authority; it does not announce an enforcement action or penalty.

LowSecurity FailureAI/Automated Decisions
VAEnforcement ActionMultistate

U.S. Department of Transportation

Attorney General Jay Jones and a coalition of 24 attorneys general obtained a preliminary injunction blocking the Trump administration from demanding a database of state-owned records containing personal information of 17 million CDL drivers from AAMVA and from terminating over $10 million in federal funding. The lawsuits allege DOT, FMCSA, and DHS violated federal privacy laws by secretly creating a database with no guardrails on use or sharing of Social Security numbers and no public notice.

LowUnauthorized Data SharingNotice FailureSecurity Failure
NYGuidance

Various AI developers (no specific entity named)

New York Attorney General Letitia James issued an industry alert urging workers with knowledge of unsafe or illegal conduct in AI development to file confidential complaints through the OAG's secure whistleblower portal. The alert cites the OAG's monitoring of cybersecurity, economic, and other safety risks from emerging AI, and highlights the RAISE Act (effective January 1, 2027), which will require large AI developers to publicly disclose safety measures and report security incidents, as well as the SHIELD Act's data security requirements. No company was named, charged, or penalized; the alert signals impending OAG enforcement authority over AI developers.

LowAI/Automated DecisionsSecurity Failure
CTSettlementMultistate

Abbott Laboratories

Connecticut joined 39 other states and the federal government in a $384 million False Claims Act settlement with Abbott Laboratories over allegations that the company failed to manufacture powder infant formula and nutritional therapy products in compliance with federal and state requirements at its Sturgis, Michigan, and Casa Grande, Arizona facilities. Abbott allegedly manufactured formula in conditions that risked microorganism contamination and failed to disclose contamination test results to the FDA during 2019 and 2022 inspections. The settlement resolves claims that Abbott caused false claims to be submitted to the WIC program and state Medicaid programs between January 1, 2018, and December 31, 2022.

CriticalSecurity FailureNotice FailureRecord Retention

$384.2M

ORSettlementMultistate

Abbott Laboratories

Abbott Laboratories agreed to pay more than $384 million — including $977,558 to Oregon — to resolve allegations that it sold powder infant formula and nutritional therapy products made in unsafe manufacturing conditions to Medicaid and food assistance programs such as WIC between January 2018 and December 2022. Investigators found Abbott failed to maintain manufacturing equipment and control water at its Sturgis, Michigan, and Casa Grande, Arizona, facilities, and withheld test results showing contamination during FDA inspections in 2019 and 2022. The settlement was negotiated by the National Association of Medicaid Fraud Control Units on behalf of the federal government and 39 states.

CriticalSecurity FailureNotice Failure

$384.2M

CTGuidance

Hyperliquid

Attorney General William Tong issued a consumer alert warning Connecticut residents about unregulated, offshore decentralized finance (DeFi) cryptocurrency exchanges, naming GMX, Gains Network, dYdX, Aevo, Drift Protocol, Vertex Protocol, and Hyperliquid. The alert highlights risks including bypassing U.S. law via VPNs, predatory leverage up to 250x, misleading synthetic asset products, and lack of KYC protections. No enforcement action or penalty was imposed; at least one Connecticut consumer reportedly lost $200,000 deposited with an unregulated DeFi exchange.

LowDark PatternsSecurity Failure
VAEnforcement ActionMultistate

U.S. Department of Transportation

Attorney General Jay Jones and a coalition of 21 attorneys general obtained a temporary restraining order blocking the Trump administration from demanding a database of state-owned records containing sensitive personal information of 17 million commercial drivers from AAMVA. The lawsuits allege the federal agencies violated federal privacy laws and the Administrative Procedure Act by seeking to acquire the data without guardrails or public notice.

LowUnauthorized Data SharingSecurity Failure
COEnforcement Action

Home Defense Solutions

Colorado contractor Rocco Roberts was criminally charged for defrauding a Boulder family during an asbestos remediation project. He allegedly misrepresented his licensing, performed the abatement improperly, exposed the home to asbestos, and provided a fraudulent clearance test. Roberts collected $8,400 for the work and faces felony charges including hazardous substance incident, forgery, and theft.

LowSecurity Failure
FTCSettlement

Elite Events and Tickets LLC

The FTC alleged that Elite Events and Tickets LLC, doing business as Smart Scalpers, violated the Better Online Ticket Sales Act by circumventing security measures to bypass ticket purchase limits for over 2,400 events, reselling tickets at a profit. The proposed order requires payment of $300,000 (with a total penalty of $10.7 million partially suspended) and permanently prohibits the company and its owners from engaging in such circumvention tactics.

MediumSecurity Failure

$300K

NYGuidance

New York Attorney General's Office

New York Attorney General Letitia James submitted testimony to the Senate Committee on Homeland Security and Governmental Affairs' Permanent Subcommittee on Investigations, calling for stronger regulations on cryptocurrency platforms to protect consumers and investors from scams. The testimony details the flood of cryptocurrency scams costing Americans billions annually and criticizes the Digital Asset Market Clarity Act for undermining state enforcement efforts.

LowSecurity Failure
VASettlementMultistate

23andMe, Inc.

Virginia Attorney General Jay Jones joined a coalition of 42 state attorneys general in a multistate settlement with 23andMe over a 2023 data breach that exposed the genetic data of approximately 6.9 million customers. The settlement requires 23andMe to pay $18 million to the states and $46.75 million to affected consumers, resolving allegations of inadequate security practices and delayed breach notification.

CriticalData BreachSecurity FailureHealth Data

$18.0M

VASettlementMultistate

23andMe

Attorney General Jay Jones joined 42 attorneys general in a multistate settlement with 23andMe's bankruptcy trustee over a 2023 data breach that compromised genetic data of nearly 7 million customers. The settlement includes $150 million in allowed claims, with immediate recovery of $18 million from bankruptcy funds, of which Virginia receives $662,649. The settlement also requires enhanced data security measures and consumer protections for the new entity, 23andMe Research Institute.

MediumData BreachSecurity FailureHealth Data

$663K

TXSettlementMultistate

23andMe

Texas Attorney General Ken Paxton secured a $150 million multistate settlement against 23andMe following a 2023 data breach that exposed genetic and personal data of 6.9 million consumers. The settlement resolves bankruptcy claims and requires enhanced data security, risk assessments, and an independent advisory board, with immediate recovery of $18 million from bankruptcy funds.

CriticalData BreachSecurity FailureBreach Notification Delay

$150.0M

NYSettlementMultistate

23andMe

New York Attorney General Letitia James and a bipartisan coalition of 42 other attorneys general secured an $18 million settlement from genetic testing company 23andMe for failing to protect customers' private genetic data. The October 2023 data breach exposed sensitive genetic information of 6.9 million consumers, including 305,245 in New York, with some data published for sale on the dark web. The settlement includes monetary penalties and new data protection requirements for the company and its successor, 23andMe Research Institute.

CriticalData BreachSecurity FailureBreach Notification Delay

$18.0M

CTSettlementMultistate

23andMe

Attorney General William Tong led a coalition of 42 attorneys general in a settlement with the bankruptcy trustee for 23andMe, resolving allegations from a 2023 data breach that compromised the genetic data of 6.9 million customers. The settlement includes $150 million in allowed claims, with $18 million paid from bankruptcy funds, and requires enhanced data security measures for the new entity holding the data.

HighData BreachSecurity FailureHealth Data

$18.0M

ORSettlementMultistate

23andMe

A coalition of 42 state attorneys general settled bankruptcy claims against 23andMe following a 2023 data breach that compromised genetic data of 6.9 million customers. The settlement includes $150 million in allowed claims, with $18 million paid from bankruptcy funds, and requires enhanced data security measures for the successor entity, 23andMe Research Institute.

HighData BreachSecurity FailureHealth Data

$18.0M

NJSettlementMultistate

23andMe, Inc.

Attorney General Jennifer Davenport joined a bipartisan coalition of 42 attorneys general in announcing a settlement with the bankruptcy trustee for 23andMe, resolving allegations from a 2023 data breach that compromised genetic data of 6.9 million people worldwide, including nearly 150,000 in New Jersey. The settlement provides $18 million to states from available bankruptcy funds, plus enhanced data security and consumer deletion rights for the successor entity, 23andMe Research Institute.

CriticalData BreachSecurity FailureBreach Notification Delay

$18.0M

COSettlementMultistate

23andMe, Inc.

A coalition of 42 state attorneys general settled with the bankruptcy trustee for 23andMe over a 2023 data breach that exposed genetic data of 6.9 million customers. The states will receive $18 million from bankruptcy funds, and 23andMe agreed to enhanced data security requirements and consumer deletion rights as part of the asset sale to TTAM Research Institute.

HighData BreachSecurity FailureBiometric Data

$18.0M

MNSettlementMultistate

23andMe, Inc.

A coalition of 42 state attorneys general reached a settlement with the bankruptcy trustee for 23andMe over a 2023 data breach that compromised the genetic data of 6.9 million customers. The settlement provides $18 million from bankruptcy funds, with Minnesota receiving $514,871, and imposes data security requirements on the successor entity, 23andMe Research Institute.

HighData BreachSecurity FailureBreach Notification Delay

$18.0M

TXSettlementMultistate

Block, Inc.

Attorney General Ken Paxton secured a $45 million multistate settlement with Block, Inc. (Cash App) for misleading consumers about the safety of its platform and failing to protect users from fraud. The settlement requires Cash App to maintain 24-hour customer support, cease deceptive safety claims, and fulfill its legal duty to investigate and reimburse unauthorized transactions.

CriticalSecurity FailureNotice Failure

$45.0M

NYSettlementMultistate

Block, Inc.

New York Attorney General Letitia James and a bipartisan coalition of 45 other attorneys general secured $45 million from Block, Inc., the company behind Cash App, for misleading users about the platform's security and failing to protect them from fraud. The settlement requires Block to implement changes including maintaining live customer support, stopping misleading marketing, and fulfilling legal obligations to investigate fraud claims and reimburse users for unauthorized transactions.

CriticalSecurity FailureNotice FailureConsent Failure

$45.0M

CTSettlementMultistate

Block, Inc.

Attorney General Tong announced a $45 million multistate settlement with Block, Inc., the company behind Cash App, for misleading consumers about the safety of the platform, failing to protect users from fraud, and not providing promised fraud protection and resolution services. The settlement requires Block to implement major reforms including real customer support, transparent communications, and security commitments, and reaffirms Block's commitment to distribute between $75 million and $120 million to compensate consumers as part of a separate CFPB settlement.

HighSecurity FailureNotice FailureConsent Failure

$45.0M

NJSettlementMultistate

Block, Inc.

Block, Inc. agreed to a $45 million multistate settlement with 46 states for allegedly misleading consumers about the safety of Cash App, failing to protect users from fraud, and not providing promised fraud protection. The settlement requires Block to improve customer support, stop misleading claims, and educate consumers about fraud.

CriticalSecurity FailureNotice Failure

$45.0M

VASettlementMultistate

Block, Inc.

Block, Inc., the parent company of Cash App, agreed to a $45 million multistate settlement with 46 states for misleading consumers about the safety of Cash App and failing to protect users from fraud. The settlement requires Block to improve customer support, stop deceptive marketing, and fulfill legal obligations to investigate fraud and reimburse unauthorized transactions.

CriticalNotice FailureSecurity Failure

$45.0M

Explore Enforcement Data